Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

How can one prevent specific or any wine applications from accessing the internet?

When using certain applications under Windows, they were trying to access the internet from time to time without any obvious reason. I was able to prevent that behaviour with a personal firewall back then. Unfortunately I did not find an application level firewall in Ubuntu up to now. This is especially annoying when I am abroad using data-roaming with my 3G modem.

share|improve this question
    
You can try my noinet preload. askubuntu.com/questions/249826/… –  escor Dec 19 '13 at 13:35

3 Answers 3

up vote 16 down vote accepted

There's a nice tutorial on blocking any given program from accessing the Internet on the Ubuntu forums.

It basically involves creating a new group, denying it Internet access, and then running any program you want to restrict as that group ID. So in your case, you would just always run wine using the method described in the tutorial.

share|improve this answer
1  
Thank you, that's it! But I don't understand, why someone has voted you down. Your answer is exactly what I had hoped for. –  YSN Dec 30 '10 at 22:03
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy"=dword:00000001
"ProxyEnable"=dword:00000001
"ProxyHttp.1.1"=dword:00000000
"ProxyOverride"="<local>"
"ProxyServer"="http://NonExistantProxyAddress:80"
"User Agent"="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1"

to add to your wine (or playonlinux virtual drives) registry :

much simpler solution indeed than using groups (& does not prevent pol to connect, just the apps)

credits to http://ootput.wordpress.com/2011/06/06/block-wine-applications-from-the-internet/comment-page-1/

EDIT : waiting for the geek in the comment to add registry settings to block TCP, in the mean time : http://support.microsoft.com/en-us/kb/154596 (sounds like setting ports to zero or creating some config error will indeed block tcp/udp connections; but i haven't faced that issue quite yet, so i don't have the need for a work around)

share|improve this answer
    
this only blocks access for software which honors proxy settings, most dont obviously... so this is not a valid solution! –  K1773R Mar 24 at 8:35
    
like which one ? (all software i've been using with pol were blocked indeed). hence i'm not convinced by your statement : it is valid in many cases, might not be in some, but which one ? –  mikakun Mar 25 at 20:34
    
no its not. eg; any software that just connects to a host:port via TCP will continue to function. A HTTP proxy setting is something a program has to recognize and honor. If you dont believe me, get/compile software which connects to another host via TCP and see it for yourself. –  K1773R Mar 26 at 21:47
    
i'm not sure what's the most annoying ? your childish arrogance or your inability to understand semantic, language & answer a simple question like "which one ?" as to name one soft. so semantic lesson it is : if it's valid for so many instances you cannot just state it's not valid, that small details does make you wrong. you may be stack at the 0 OR 1 hypothesis but life is more complex : 0 & 1, nor 0, nor 1 are present state in the universe. but can't ask a geek to think differently than the "0 or 1" paradigm i guess –  mikakun Mar 28 at 10:14
    
also a good geek would propose the registry settings to block tcp as well as to improve the answer & make it MORE VALID (until another smart ass find another exception & ITS WORK AROUND) & actually render his contribution as useful (as opposed to useless; do i need to define useless ? -> look at you!) –  mikakun Mar 28 at 10:32

make a group and become a member of it

groupadd wino

adduser yourusername wino

now enter an iptables rule to block that group from using the internet you can type this on the terminal and hit enter

iptables -A OUTPUT -m owner --gid-owner wino -j REJECT

to make this rule run after each reboot you can put it in /etc/rc.local (make sure the last line in that text file says exit 0)

usage example:

sg wino "wine executablename.exe"

yes you need the " " and also type wine before the programs name.

share|improve this answer
1  
I've edited your usermod command to add -a. Without -a, you will end up removing the user from all other supplementary groups (like admin, cdrom, etc.)! It is also more convenient to use addgroup/adduser. –  gertvdijk Jul 14 '13 at 17:50
    
was just about to fix the -a myself. yes do not start wine as root !. only need root to make the iptables rule. the usage example was for normal user after doing those steps. –  mark Jul 14 '13 at 17:52
    
ah sorry, my mistake. removed comment. –  gertvdijk Jul 14 '13 at 17:53
    
@gertvdijk I edited the commands once more, adduser <username> <groupname> is the sensible thing here. –  guntbert Jul 14 '13 at 17:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.